Security is 28% of Core 2 and Software Troubleshooting adds another 23%. These domains overlap because suspicious symptoms can come from malware, unsafe configuration, browser changes, account misuse, or ordinary software failure.
The useful first question is not "Which security term do I remember?" It is what is happening now and what action is safe at this stage?
Fast rule: Prevent when you can, contain active harm before it spreads, remediate from known evidence, then harden and educate so the same path is less likely to work again.
1. Security decision map
| Clue | Think first | Purpose |
|---|---|---|
| User needs temporary elevated rights | Run as administrator / controlled elevation | Avoid permanent excessive privilege |
| Active malware may spread | Quarantine/isolate | Contain before cleanup |
| Lost managed phone | Locator and remote wipe | Find device or protect data |
| Old drive will be reused | Wipe/erase | Prevent ordinary recovery of previous data |
| Router still has factory settings | Change admin credential and update firmware | Remove default-access and known-vulnerability risk |
| Pop-ups, redirects, disabled security | Security troubleshooting | Verify malware or malicious configuration before unrelated repair |
2. Keep authentication, privilege, and permissions separate
Security controls often solve different parts of the same login.
- Authentication verifies identity.
- Authorization/permissions determine what the identity may access.
- Multifactor authentication (MFA) strengthens authentication by using more than one factor category.
- Standard user limits ordinary privileges.
- Administrator/elevation provides higher privilege when approved work requires it.
- User Account Control (UAC) helps control Windows privilege elevation.
If a standard user needs one approved maintenance utility, temporary elevation is safer than making the user a permanent administrator.
File permissions, share permissions, group membership, and local/admin rights should follow least privilege. Do not give broad rights just because it makes one support task easier.
3. Match wireless and SOHO security to the control point
Core 2 includes WPA2/WPA3, encryption methods, centralized authentication concepts, and small-office/home-office router hardening.
Useful distinctions:
- WPA2/WPA3: wireless security protocols
- AES/TKIP: encryption-method context within wireless-security generations
- RADIUS: common centralized network-access authentication/AAA role
- TACACS+: commonly associated with centralized network-device administration
- Kerberos: ticket-based authentication used in supported domain environments
- MFA: strengthens user authentication across many systems
For a new SOHO router, high-value actions include:
- Change default administrative credentials
- Install current firmware
- Use strong supported Wi-Fi security
- Disable unnecessary services/features
- Limit remote management
- Use guest access when untrusted devices should be separated
- Protect management access from the public internet
Turning on every convenience feature is not the same as securing the router.
4. Use the behavior to identify the threat category
Common security clues include:
- Business Email Compromise (BEC): trusted-business impersonation used to trigger payment or another fraudulent action
- Phishing: deceptive message intended to steal credentials, deliver malware, or trigger unsafe action
- QR-code phishing: malicious or deceptive QR destination
- Tailgating: following an authorized person into a restricted physical area
- Shoulder surfing: observing sensitive information or input
- Ransomware: encrypts or otherwise denies access to data for extortion
- Trojan: malicious software presented as or bundled with something legitimate
- Rootkit: hides privileged malicious activity
- Spyware/keylogging: monitors activity or captures information
- Potentially unwanted applications: software that may create intrusive or risky behavior without fitting every malware definition
Symptoms such as browser redirects, disabled security tools, unusual network traffic, unexpected encryption, repeated pop-ups, changed files, or unknown applications deserve investigation.
A certificate warning can be a security clue or a configuration/time/trust problem. Do not click through automatically.
5. Know the current SOHO malware-removal order
The 220-1202 objective gives a specific basic SOHO sequence.
- Investigate and verify malware symptoms.
- Quarantine the infected system.
- Disable System Restore in Windows Home.
- Remediate the infected system.
- Update anti-malware software.
- Use appropriate scan and removal techniques, including Safe Mode or a preinstallation environment when needed.
- Reimage/reinstall when cleanup cannot produce a trustworthy result.
- Schedule scans and run updates.
- Enable System Restore and create a clean restore point in Windows Home.
- Educate the end user.
The order has a reason. Quarantine limits spread before cleanup. Disabling System Restore prevents an infected restore point from reintroducing the problem. Updates and scanning happen during remediation. System Restore returns only after the system is clean enough to create a useful restore point.
Sequence clue: If malware is active, containment comes before scanning. If remediation fails or trust cannot be restored, reimage/reinstall is stronger than repeatedly trying unrelated cleanup tools.
6. Harden workstations and mobile devices around likely misuse
Workstation hardening can include:
- Data-at-rest encryption
- Strong password policy
- Screen lock and session timeout
- Account lockout and expiration where appropriate
- Disabling guest/default or unnecessary accounts
- Disabling unused services and AutoRun where appropriate
- Firmware/UEFI passwords and supported security settings
- Current patches and endpoint security
- Standard-user operation for normal work
- Protecting sensitive information and credentials
Mobile-device controls can include:
- Device encryption
- Screen lock/biometrics
- Current operating system and application patches
- Mobile Device Management (MDM)
- Endpoint security where supported
- Locator capability
- Remote lock or wipe
- Controlled application sources
Hardening should reduce unnecessary capability without making the device unusable for its approved job.
7. Choose data destruction and browser controls from the goal
Deleting a file or emptying the Recycle Bin does not sanitize a drive.
Useful distinctions:
- Wiping/erasing: appropriate when media will be reused and prior data must not remain ordinarily recoverable
- Formatting: creates/recreates filesystem structures but is not automatically the strongest sanitization method
- Physical destruction: appropriate when media should not be reused and destruction meets policy
- Outsourced destruction: can be appropriate when chain of custody, evidence, and vendor controls meet organizational requirements
Browser security can involve:
- Updates/patching
- Trusted extensions only
- Password-manager use
- Certificate warnings
- Privacy settings
- Proxy settings
- Secure DNS configuration
- Clearing risky or unwanted browser changes
Persistent redirects after malware cleanup can point toward proxy, DNS, hosts-file, extension, or browser-setting changes rather than a failing hard drive.
8. Read software symptoms before resetting the system
| Symptom | Useful starting point |
|---|---|
| Windows will not boot normally | Recent change, recovery environment, Safe Mode, boot/configuration evidence |
| Frequent application crashes | Event logs, application update, compatibility, resources, corrupted files |
| System is suddenly slow | Task Manager/resource use, disk space, startup items, updates, malware evidence |
| Browser redirects/pop-ups | Malware, extensions, proxy/DNS/browser settings |
| Mobile app will not update | Storage, connectivity, account/store state, OS/app compatibility |
| Mobile device has suspicious ads/data use | Malicious/untrusted app, unsafe source, account or network compromise |
Use the least disruptive safe action that fits the evidence. A factory reset or OS reinstall is powerful, but it should not be the automatic first answer when a narrower cause is clear.
9. Scenario comparisons
Ransomware is actively encrypting files on a shared-network PC
Quarantine the system from the network first. Containment protects other systems and shared data before the cleanup sequence continues.
Standard user needs one approved admin-only utility
Use controlled elevation rather than permanent Administrators-group membership.
Company phone with business data is lost
Locator functionality may help recovery; remote wipe protects data if recovery is not possible.
Old employee drive will be issued to someone else
Use an approved wipe/erase method appropriate for reuse rather than relying on file deletion or ordinary formatting alone.
Browser redirects continue after anti-malware scan
Check browser extensions, proxy/DNS configuration, hosts-file or browser settings, and other persistence clues.
Router is new from the box
Replace default administrative credentials and update firmware before exposing it to normal use.
10. Common exam traps
- Scanning an infected system before quarantining it when active spread is possible.
- Creating a restore point before malware removal is complete.
- Leaving System Restore disabled after the cleanup process is finished.
- Giving permanent administrator rights for one approved task.
- Treating MAC address or a password alone as strong identity proof in every scenario.
- Treating WPA2/WPA3 as encryption algorithms instead of wireless-security protocols.
- Treating ordinary formatting as the strongest data-destruction answer.
- Factory-resetting a device before checking a clear storage, update, or configuration cause.
- Clicking through certificate warnings without investigating them.
- Fixing a browser redirect with hardware replacement.
- Assuming every pop-up is harmless adware.
- Hardening by disabling something the user actually needs without checking the requirement.
11. Rapid review grid
| Clue | Think first |
|---|---|
| Active malware spread risk | Quarantine/isolate |
| Temporary admin need | Controlled elevation |
| Lost managed phone | Locator and remote wipe |
| Drive reuse | Approved wipe/erase |
| Executive payment impersonation | BEC |
| Persistent browser redirects | Malware/configuration persistence |
| Factory router | Change defaults and patch firmware |
| Cleanup cannot restore trust | Reimage/reinstall |